Repairing file structure and partition table on internal HDD

[SpyderTracks]

Hi all

I've made a rookie mistake this morning, stupidly set a chkdsk /r on one of my HDD's on the server to run at boot instead of unmounting the drive first. I couldn't have the server offline for 8 hours, so force rebooted and it's left that drive in a RAW state after reboot.

Have to stress, I don't think there's anything wrong with the drive itself, and I'm fairly certain the data is intact, I think it's either the partition table or the file system that needs repairing.

Chkdsk unfortunately cannot read the volume as it's in RAW, so I can't do a chkdsk /f which is what I'd normally run.

Minitool can read the drive successfully as NTFS.

I've seen reports that this can happen when the drive has "require check" flag set through chkdsk which prepares it for a reboot scan.

Worst comes to the worst I can recover the data and reformat the drive, but I'd like to first see if I can repair the partition table and file system.

I've come across an open source tool called TestDisk which has very good reviews and may be able to repair the partition table:

Partition Recovery and File Undelete

TestDisk is a free and open source data recovery software tool designed to recover lost partition and unerase deleted files.

www.cgsecurity.org

I was wondering if anyone knew if GParted would be a good option? @ubuysa I know you're quite familiar with it?

Any advice much appreciated, hope you're all having a good sunday!

 

[ubuysa]

Hi all

I've made a rookie mistake this morning, stupidly set a chkdsk /r on one of my HDD's on the server to run at boot instead of unmounting the drive first. I couldn't have the server offline for 8 hours, so force rebooted and it's left that drive in a RAW state after reboot.

Have to stress, I don't think there's anything wrong with the drive itself, and I'm fairly certain the data is intact, I think it's either the partition table or the file system that needs repairing.

Chkdsk unfortunately cannot read the volume as it's in RAW, so I can't do a chkdsk /f which is what I'd normally run.

Minitool can read the drive successfully as NTFS.

I've seen reports that this can happen when the drive has "require check" flag set through chkdsk which prepares it for a reboot scan.

Worst comes to the worst I can recover the data and reformat the drive, but I'd like to first see if I can repair the partition table and file system.

I've come across an open source tool called TestDisk which has very good reviews and may be able to repair the partition table:

Partition Recovery and File Undelete

TestDisk is a free and open source data recovery software tool designed to recover lost partition and unerase deleted files.

www.cgsecurity.org

I was wondering if anyone knew if GParted would be a good option? @ubuysa I know you're quite familiar with it?

Any advice much appreciated, hope you're all having a good sunday!

Actually I'm not that familiar with gparted but any of the free data recovery tools should be able to recover the drive.

 

[SpyderTracks]

TestDisk managed it, was very easy, had to wait to test until just now as had a chkdsk /r going on another drive.

I had rebooted twice to see if that would resolve the issue, but no luck.

Ran TestDisk, simply analysed the partition structure which found the correct NTFS partition intact. I simply rewrote that to the drive and rebooted.

Drive was found instantly after reboot and all data intact.

That tool is very nice, no nonsense, command based, simple and effective low level stuff.

I do believe this was just the issue where the "needs reboot" flag was set on the drive which apparently is quite common in exiting chkdsk /r early, and windows has no way of resetting the flag if chkdsk can't read the drive as it's seen as being in RAW format.

I'm quite relieved, it was 4Tb of media, I could have downloaded it all again but would have taken hours.

Crisis averted

 

[AgentCooper]

Phew!

 

[Martinr36]

 

[ubuysa]

I do believe this was just the issue where the "needs reboot" flag was set on the drive which apparently is quite common in exiting chkdsk /r early, and windows has no way of resetting the flag if chkdsk can't read the drive as it's seen as being in RAW format.

I suspect you're right, chkdsk doesn't require a drive demount just for the fun of it.

Very glad you got it sorted, and thanks for the TestDisk tip too!

 

[JakAttack]

Useful. This is how we all learn things